99905b87aaf318643d3670fc76ce7c2a707123f24942756f55c755e6a0911339 | Triage

Sharing

General

Target

bins.sh
Size

10KB
Sample

241124-dl3bzsxlem
MD5

01901ff2d037e722d3824326fb92b79a
SHA1

e06031bbd3407d4b35228a26b1e27b1ef3f600f3
SHA256

99905b87aaf318643d3670fc76ce7c2a707123f24942756f55c755e6a0911339
SHA512

83c192b3146c96b129597142ce68bf66cab3aecf299770481e1cb1127bed05d5fad7ce5891567a2f29c5a5aa344d69713673c3d98fd81796beb896ce84ef073a
SSDEEP

192:aBxoP799s9W4oEyoESoExoEcoEgoEpNS7deoEyoESoExoEcoEgoE8BxoP794:P9s9W9ELErEeEBElErS7BELErEeEBElh

Score

9^/10

antivm defense_evasion discovery execution linux persistence privilege_escalatio

Malware Config

Targets

- Target
  
  bins.sh
- Size
  
  10KB
- MD5
  
  01901ff2d037e722d3824326fb92b79a
- SHA1
  
  e06031bbd3407d4b35228a26b1e27b1ef3f600f3
- SHA256
  
  99905b87aaf318643d3670fc76ce7c2a707123f24942756f55c755e6a0911339
- SHA512
  
  83c192b3146c96b129597142ce68bf66cab3aecf299770481e1cb1127bed05d5fad7ce5891567a2f29c5a5aa344d69713673c3d98fd81796beb896ce84ef073a
- SSDEEP
  
  192:aBxoP799s9W4oEyoESoExoEcoEgoEpNS7deoEyoESoExoEcoEgoE8BxoP794:P9s9W9ELErEeEBElErS7BELErEeEBElh
Score

9^/10

discovery antivm defense_evasion execution persistence privilege_escalatio
- Contacts a large (2171) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- File and Directory Permissions Modification
  Adversaries may modify file or directory permissions to evade defenses.
  defense_evasion
- Executes dropped EXE
- Renames itself
- Creates/modifies Cron job
  Cron allows running tasks on a schedule, and is commonly used for malware persistence.
  execution persistence privilege_escalatio
- Enumerates running processes
  Discovers information about currently running processes on the system
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Cron

Persistence

Scheduled Task/Job

Cron

Privilege Escalation

Scheduled Task/Job

Cron

Defense Evasion

File and Directory Permissions Modification

Linux and Mac File and Directory Permissions Modification

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

Network Service Discovery

System Network Configuration Discovery

Virtualization/Sandbox Evasion

System Checks

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

antivmdiscovery

behavioral3

defense_evasiondiscoveryexecutionpersistenceprivilege_escalatio

behavioral4